Slashdot Mirror

← Back to Stories (view on slashdot.org)

Symantec Finds Server Containing 44 Million Stolen Gaming Credentials

Posted by Soulskill on from the who-wants-to-buy-a-level-80-paladin dept.

A Symantec blog post reports that the company recently stumbled upon a server hosting the stolen credentials for 44 million game accounts. It goes on to explain how the owners of the server made use of a botnet to process that mountain of data: "Now it's time to turn those gaming credentials into hard cash. But how do you find out which credentials are valid and thus worth some money? Three options come to mind: 1) Log on to gaming websites 44 million times! 2) Write a program to log in to the websites and check for you (this would take months). 3) Write a program that checks the login details and then distribute the program to multiple computers. Option one naturally seems next to impossible. Option two is also not very feasible, since websites typically block IP addresses after multiple failed login attempts. By taking advantage of the distributed processing that the third option offers, you can complete the task more quickly and help mitigate the multiple-login failure problems by spreading the task over more IP addresses. This is what Trojan.Loginck's creators have done."

14 of 146 comments (clear)

  1. Re:I must be new here by Monkeedude1212 · · Score: 4, Informative

    Don't tell me that people buy stolen creds and log into them just to take all their e-loot (worth thousands of e-dollars)? Oh for the love of humanity the things people will do in the name of wasting time.

    No, this is often the people who STOLE the creds, log in, and sell the E-loot for REAL money. If you've never played WoW, Eve, or Runescape for more than a Month, I wouldn't expect you to understand. But this is a problem that does occur regularly.

  2. Damn it. by LupidStupy · · Score: 5, Funny

    Mom!!!! Symantec hacked my server again.

  3. They should post the usernames... by BobMcD · · Score: 4, Interesting

    They could, as a service to the online community, go ahead and post the usernames that are compromised.

    1. Re:They should post the usernames... by JWSmythe · · Score: 4, Interesting

          I used to have a lot of fun with that, when I was the sysadmin for a large site. It seemed every script kiddie wanted the password to it. It showed up regularly on passwordz sites. We had a whole bunch of triggers to detect and resecure accounts. One of the easy and obvious ones was to let them post it, and catch it afterwards (usually within seconds of being posted). The legitimate account holder got a notification that we changed their password to a secure one. Everyone else just sat there and wondered how we'd catch them so fast.

          That trigger was pretty low on the list though. My favorite was to catch 'em scanning for passwords. If they tried say 1000 wrong passwords in a short period, but got one or two right, we'd let them keep scannning for a while, and then block their access to the server. (iptables drop rule). Then the program would figure out which passwords they actually got right, change those, and notify the account holder of their new password. :) It was always fun to see what the delay was between them finding a password, and when it started being used from passwordz sites. In those cases, we always had the account secured before they had time to post it. The typical time from being scanned to being posted was about 12 hours. The typical time for us to reissue the passwords was less than 5 minutes.

          I can't imagine online game places wouldn't have something similar. Brute force attacks are just too easy, and people will always try them. How many different usernames can a person really try before you know that they're just brute force attacking.

      --
      Serious? Seriousness is well above my pay grade.
  4. Re:I must be new here by keithjr · · Score: 3, Insightful

    Is the buyer really going to come back and demand a refund when it doesn't work?

    Probably not, but reputation must be worth something in criminal enterprises. Giving out a bunch of bogus products kills the word-of-mouth.

    And what real benefit are these, anyway? Well, all the criminal has to do is sell off the account for less than the game costs up-front. They make pure profit and people willing to buy stolen games get a discount. Steam accounts could probably be quite lucrative, for instance.

  5. And if I did this... by FrankSchwab · · Score: 3, Insightful

    OK, so Symantec "recently stumbled upon a server hosting...".

    What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?

    So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?

    And the penalty if I did that is, what, 5 years in federal PMITA prison?

    There is something wrong in this world.

    --
    And the worms ate into his brain.
    1. Re:And if I did this... by BobMcD · · Score: 4, Insightful

      And the penalty if I did that is, what, 5 years in federal PMITA prison?

      There is something wrong in this world.

      You're quite wrong. This is an example of one of the few somethings that is right in this world. Selective enforcement is designed into the system, along with jury nullification, to help the laws achieve ends that keep the public they support happy. Any "completely fair" application of the law would make it unworkable in very short order.

      Could you imagine a robot issuing you indecency citations every time you pass gas in public? Could you imagine a police officer doing the same if you passed gas into a megaphone-amplified-sound-system aimed at, say, an Inaugural speech? Context is key, and thankfully so.

    2. Re:And if I did this... by InsertWittyNameHere · · Score: 3, Funny

      It was probably one (some) of their client's servers that got hacked and used in the collection of the credentials. The client found out that they got hacked and demanded that Symantec explain what happen. Symantec investigated and found out.

      They're not going to say "a server we were protecting with our products got hacked and was used in an operation to steal 44 million credentials..."

    3. Re:And if I did this... by TubeSteak · · Score: 4, Interesting

      OK, so Symantec "recently stumbled upon a server hosting...".

      What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?

      So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?

      Symantec and many other companies set up honeypot computers.
      The honeypot gets infected, Symantec pulls apart the trojan and studies its web traffic.
      This usually leads to the dumpsite where the trojan is uploading the data.

      Many botnet/trojan masters don't bother to encrypt their data dumps or secure the server hosting it.
      And even if they did, are they going to sue Symantec for unauthorized access?

      --
      [Fuck Beta]
      o0t!
    4. Re:And if I did this... by BForrester · · Score: 4, Informative

      RTFA. This is not a case of Symantec hammering through random servers looking for bogeymen.

      The very first sentence of the article states that the server was flagged from a new set of sample data submitted to Symantec. This is likely user data aggregated from Norton's threat detection network.

    5. Re:And if I did this... by KahabutDieDrake · · Score: 3, Insightful

      Neither of the cases you cite are actually illegal. This is a key feature of the law, if something isn't codified as illegal, it's NOT ILLEGAL. The context is effectively null, since the example isn't valid.

      You say that any completely fair application of the law would make it unworkable. That is the biggest pile of bullshit I've seen on /. in a long long time. Believe me, that's saying something. ONLY a completely fair application of the law works. Our founding fathers knew this. Our ancestors knew this. The fact that you don't know this is frightening beyond reason. You didn't say, but you implied that symantec should have rights and privileges that an ordinary citizen does not. That is the largest perversion of the law that is possible. Companies do not have any trust, they can't be given confidence, because they exist for ONLY one purpose, to make money. You can trust a person, you can't trust a company, and even attempting to do so is foolish (at least) and IMNSHO stupid beyond belief. Our entire foundation of laws is based on the INDIVIDUAL being the top, and everything else coming second. If you know believe that corporations should be on top (they are, but they should not be), well, we've already lost, haven't we?

    6. Re:And if I did this... by idontgno · · Score: 4, Funny

      We don't care about your sick perverted little secret fetishes.

      Oh, "tyranny." Never mind.

      --
      Welcome to the Panopticon. Used to be a prison, now it's your home.
    7. Re:And if I did this... by Monkeedude1212 · · Score: 3, Interesting

      You know "IMHO" can sometimes be interpretted as "honest" and not "humble" right?

  6. Re:I must be new here by BobMcD · · Score: 4, Insightful

    Oh for the love of humanity the things people will do in the name of wasting time.

    One man's wasted time is another man's Sistine Chapel, or pornography collection, or fictitious language for a fantasy book series.

    From the moment you open your eyes in the morning until you close them at night you're passing time. Whether or not it is wasted depends entirely on whether or not you regret how you spent it.